EUVD-2026-105558
GHSA-r5r7-q7wc-9345
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger use-after-free in Transactions Platform
-
ExecutionReclaim freed object with controlled data
-
ImpactExecute arbitrary code inside renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load an attacker-controlled HTML page in an unpatched Google Chrome (any version prior to 156.0.8078.47); this is a drive-by/crafted-page vector against default configurations, with no authentication needed (PR:N). The key limiting factors are: (1) user interaction is mandatory (UI:R) - the victim must navigate to or render the malicious content; and (2) resulting code execution is confined to the renderer sandbox (scope Unchanged), so full system compromise additionally requires a separate sandbox-escape vulnerability not covered by this CVE. No special non-default feature or setting is named in the description. |
| Impact | Signals conflict and should temper the headline number. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8 High) treats this as a network-reachable, unauthenticated, low-complexity flaw needing only user interaction, which looks severe. However, the description explicitly states code execution occurs 'inside the sandbox,' and Chromium itself rated the security severity only Medium - the renderer process is confined, so without a separate sandbox-escape chain this does not by itself yield host compromise, which is why the CVSS scope is Unchanged (S:U) rather than Changed. No EPSS probability was supplied, there is no CISA KEV listing, and no public exploit was identified at time of analysis, so there is no evidence of active exploitation or weaponization. Net assessment: a credible but not emergency priority - patch promptly as part of routine browser update hygiene rather than as a drop-everything incident, recognizing that use-after-free renderer bugs are a historically favored starting point for exploit chains even though this one, on its own, is contained by the sandbox. |
| Exploit ScenarioDerived | An attacker crafts a malicious HTML page that triggers the use-after-free in Chrome's Transactions Platform component and lures a victim to visit it (e.g., via phishing link or malicious ad). When the page loads, the freed object is reclaimed with attacker-controlled data, yielding arbitrary code execution within the renderer sandbox. No public exploit code was identified at time of analysis, and full host compromise would require chaining an additional sandbox-escape vulnerability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Use-after-free in Google Chrome's Transactions Platform lets a remote attacker execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page, affecting all builds prior to 156.0.8078.47. Exploitation is unauthenticated per the CVSS vector (PR:N) but requires the user to navigate to attacker-controlled content (UI:R), and because scope is Unchanged the resulting code execution is confined to the sandbox - full host compromise would require chaining a separate sandbox escape. Severity signals conflict and should temper the headline score: NVD-style scoring yields 8.8 while Google rates this Chromium severity Medium, and no CISA KEV listing or public exploit code was identified at time of analysis, so the practical risk is best framed as a high-impact but interaction-gated memory-corruption primitive rather than a confirmed actively exploited threat.
RemediationAI
Upgrade Google Chrome to 156.0.8078.47 or later - vendor-released patch: 156.0.8078.47, documented in the stable-channel advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html. Relying on the built-in updater is insufficient for assurance on managed fleets: verify the installed version via chrome://settings/help or your endpoint inventory, force a relaunch of browsers that have downloaded but not applied the update, and track the equivalent fixed build for any Chromium-based browsers you run, since they inherit the same component. No configuration toggle removes the vulnerable code path, so compensating controls are necessarily about limiting exposure until the patch lands: restrict or filter browsing to untrusted and newly registered domains through enterprise URL filtering or a secure web gateway (trade-off: false positives on legitimate sites and added latency), and consider disabling JavaScript for high-risk browsing profiles (trade-off: breaks most modern web applications, so it is only practical for isolated kiosk or high-assurance sessions). Keep the renderer sandbox and site isolation enabled and do not weaken them, since the sandbox is the layer that caps this bug at in-renderer code execution; disabling it would convert a chained-exploit requirement into direct host compromise. Egress filtering and post-exploitation detection should assume a renderer compromise is possible from a single page view, as the user-interaction requirement means phishing-style delivery is the realistic vector.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-416 use-after-free, the classic memory-safety class in which the Transactions Platform component frees an object while a reference to it remains reachable, so subsequent dereference reads or writes attacker-influenced memory. In Chromium's multi-process architecture this corruption occurs in the renderer process, which is exactly the boundary the sandbox is designed to contain - hence the assessed scope of Unchanged even though the CVSS confidentiality, integrity and availability impacts are all High. The attack surface is web-reachable (AV:N/AC:L) through crafted HTML, meaning the vulnerable code path is exercised by ordinary browsing of a malicious or compromised page, with no credentials or non-default configuration required; the only gate is user interaction, since the victim must actually render the page. Google's advisory credits the Chrome CVE admin and links a restricted Chromium issue tracker entry (issues.chromium.org/issues/514018015), which is typical for unfixed-at-disclosure memory-corruption bugs where technical detail is withheld until users have patched.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no privileges but requiring the victim to visit it gives AV:N/PR:N/UI:R; scope stays Unchanged since execution is confined to the sandbox, with high renderer-process C/I/A impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome builds prior to 156.0.8078.47 contain a memory-corruption flaw in the Transactions Platform component that could allow attacker-supplied web content to run code inside the browser's renderer sandbox. The exposure is broad because nearly every employee who browses the web in Chrome is a potential target, but successful abuse requires a user to visit crafted content and would still be contained by the sandbox unless paired with a separate escape. A vendor fix is already published, so the organizational priority is rapid fleet remediation rather than incident response.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB